Implementation walkthrough
How to implement SOC 2: video walkthrough
A walkthrough of a SOC 2 programme: how a service organisation designs and operates controls against the Trust Services Criteria and prepares for the CPA firm's examination.
Key takeaways
- SOC 2 is an attestation report from a licensed CPA firm, not a certification.
- Security is in every report; the other four categories are added when clients need them.
- A Type 1 reports at a date; a Type 2 covers controls operating over a period.
- A readiness assessment finds exceptions before the examination period, not in the opinion.
- Evidence has to be produced continuously, so the evidence calendar starts early.
SOC 2 is an attestation, not a certificate
SOC 2 is the AICPA's framework for reporting on the controls a service organisation operates over the systems that process or protect its clients' data. A licensed CPA firm examines those controls against the Trust Services Criteria and issues a report with its opinion, management's assertion, a description of the system and, in a Type 2, the tests performed and their results. There is no certificate and no pass or fail: the CPA firm expresses an opinion and lists any exceptions it finds.
That shapes the implementation. SOC 2 does not prescribe controls; you design the controls that meet the criteria for your system, then operate them consistently enough, for long enough, to earn an opinion your clients will accept. This short film walks through that programme, and the stages below follow the SOC 2 page on this site.
The route to a SOC 2 report
Start by defining the system, the categories and the report type: the service and systems clients rely on, the locations and teams involved, whether availability, processing integrity, confidentiality or privacy join Security, and whether a Type 1, a Type 2 or both fits the deadline. A gap analysis maps existing controls to the criteria and points of focus and agrees actions with owners and dates.
Remediation closes the gaps, produces the policies and the system description, trains the people who operate the controls and starts the evidence calendar. A readiness assessment then tests the controls the way the CPA firm will, so exceptions are found and fixed before the examination period begins rather than reported in the opinion. The controls operate for the agreed period, and the CPA firm performs its walkthroughs, samples the evidence and issues its report. The opinion belongs to the CPA firm.
Sterling's expert and experienced consultants support each stage under Sterling OS™, guided or fully managed, with policies, risks, controls, evidence, vendors and changes held in Effivity.
SOC 2 at a glance
- Purpose
- Independent assurance that the controls behind your service meet the AICPA Trust Services Criteria for security and, where you choose, availability, processing integrity, confidentiality and privacy
- Relevant to
- Service organisations that hold or process client data: SaaS, cloud, BPO, fintech, managed services, payroll and professional services, at any size
- Edition
- The AICPA's 2017 Trust Services Criteria, with the revised points of focus issued in 2022; the criteria themselves are unchanged
- Attestation
- Examined and reported on by a licensed CPA firm under the AICPA attestation standards, or an equivalent practitioner under ISAE 3000 outside the US; Type 1 as at a date, Type 2 over a period
- Sterling's role
- Scope and gap analysis, control design with your team, Effivity, training, readiness assessment and support through fieldwork, then Sustain™ into the next period
- Cost and timing
- Total investment for a SOC 2 programme depends on the current maturity of your controls, the categories in scope, locations and number of employees. The process typically takes 3 to 6 months to a Type 1 report and 9 to 15 months to a first Type 2 report
SOC 2: questions people ask
Is SOC 2 a certification?
No. There is no SOC 2 certificate and no register of certified companies. The outcome is an attestation report in which a licensed CPA firm expresses an opinion on your controls against the Trust Services Criteria. Anyone offering a "SOC 2 certificate" is offering something the framework does not contain. If you want something to publish, a SOC 3 report is the general-use version of the same examination.
Type 1 or Type 2: which report should we get first?
A Type 1 reports on the design of your controls as at a date and can be issued once they are in place. A Type 2 reports on design and operating effectiveness over a period and is what most enterprise clients ask for. If a client is waiting, a Type 1 now with the Type 2 period already running is often the right sequence; if there is time, going straight to a Type 2 avoids paying for two examinations.
Which trust services categories should be in scope?
Security is always in scope. Add availability if clients rely on uptime commitments, confidentiality if you hold their confidential data under contract, processing integrity if processing accuracy matters to them, as in payments, payroll or claims, and privacy if you handle personal information on their behalf. Scope follows what your clients depend on, not what looks impressive.
Who can issue our SOC 2 report, and can Sterling issue it?
Only an independent, licensed CPA firm working under the AICPA attestation standards can issue a SOC 2 report; outside the United States, equivalent practitioners report under ISAE 3000. Sterling prepares your organisation, helps you shortlist a firm and supports you through fieldwork. Sterling does not issue the report and is not your auditor.
We are outside the United States. Does SOC 2 apply to us?
Yes. SOC 2 is requested by clients, not imposed by a regulator, so a BPO in the Philippines, a software company in India or a service provider in the UAE serving North American clients is asked for it as readily as a US company. A licensed CPA firm examines under the AICPA standards wherever you are based, or a practitioner reports under ISAE 3000.
Keep exploring
Related to this video
Read next
Services
The complete guide
Everything on SOC 2
Start with the SOC 2 page, or go straight to the guide you need.
On the SOC 2 page
Guides
- SOC 2 bridge letters, report validity and the annual cycle explained
- SOC 2 auditor questions
- SOC 2 in Australia
- SOC 2 benefits
- SOC 2 case study
- Choosing a SOC 2 service auditor
- SOC 2 common mistakes
- SOC 2 continuous monitoring
- SOC 2 cost
- Decision guide
- Effivity for SOC 2
- SOC 2 exceptions and qualified opinions
- SOC 2 gap analysis
- SOC 2 governance
- SOC 2 implementation plan
- SOC 2 in India
- SOC 2 in the Netherlands and Europe
- SOC 2 policies and evidence
- SOC 2 readiness review checklist
- How to read a SOC 2 report
- SOC 2 scope
- SOC 2 in Singapore and South East Asia
- SOC 2 for start-ups and small teams
- The SOC 2 system description
- The SOC 2 examination
- SOC 2 in the Philippines
- SOC 2 in the UK
- SOC 2 timeline
- SOC 2 training
- SOC 2 Trust Services Criteria explained
- SOC 2 Type 1 vs Type 2
- SOC 2 in the UAE and GCC
- SOC 2 vendor management and subservice organisations
By industry
More videos: Information security, cyber and cloud
- How to implement ISO/IEC 27017Implementation walkthrough · 3 min 14 s
- ISO/IEC 27017 requirements explainedTwo-minute brief · 2 min
- How to implement CMMC 2.0Implementation walkthrough · 3 min 15 s
- CMMC 2.0 requirements explainedTwo-minute brief · 2 min
- How to implement CSA STARImplementation walkthrough · 3 min 15 s
- CSA STAR requirements explainedTwo-minute brief · 2 min
- How to get Cyber Essentials certifiedImplementation walkthrough · 3 min 15 s
- Cyber Essentials requirements explainedTwo-minute brief · 2 min
- How to comply with the DESC Information Security Regulation (Dubai)Compliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your SOC 2 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice